Skip to main content

Snort CVE-2026-20067

MEDIUM
Out-of-bounds Write (CWE-787)
2026-03-04 psirt@cisco.com
5.8
CVSS 3.1 · Vendor: cisco
Share

Severity by source

Vendor (cisco) PRIMARY
5.8 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Primary rating from Vendor (cisco) · only source for this CVE.

CVSS VectorVendor: cisco

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 22:05 vuln.today
CVE Published
Mar 04, 2026 - 18:16 nvd
MEDIUM 5.8

DescriptionCVE.org

Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. 

This vulnerability is due to incomplete error checking when parsing the Multicast DNS fields of the HTTP header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.

AnalysisAI

Unauthenticated remote attackers can crash the Snort 3 Detection Engine by sending crafted HTTP packets with malformed Multicast DNS fields, causing a denial of service that interrupts packet inspection across multiple Cisco products. The vulnerability stems from incomplete error checking in HTTP header parsing and requires no authentication or user interaction to trigger. No patch is currently available for this MEDIUM severity issue.

Technical ContextAI

Classified as CWE-787 (Out-of-bounds Write). Affects Snort 3 detection engine. Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. 

This vulnerability is due to incomplete error checking when parsing the Multicast DNS fields of the HTTP header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.

More in Snort

View all
CVE-2016-1417 HIGH POC
8.8 Jan 23

Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct

CVE-2024-20342 HIGH
8.6 Oct 23

Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that

CVE-2021-40114 HIGH
7.5 Oct 27

Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic tha

CVE-2021-1223 HIGH
7.5 Jan 13

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticate

CVE-2021-40116 HIGH
7.5 Oct 27

Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attac

CVE-2017-6657 HIGH
7.5 May 16

Cisco Sourcefire Snort 3.0 before build 233 mishandles Ether Type Validation. Rated high severity (CVSS 7.5), this vulne

CVE-2020-3299 MEDIUM
5.8 Oct 21

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticate

CVE-2024-20363 MEDIUM
5.8 May 22

Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that

CVE-2026-20066 MEDIUM
5.8 Mar 04

Cisco Snort 3 Detection Engine can be remotely restarted by an unauthenticated attacker through crafted HTTP packets exp

CVE-2026-20058 MEDIUM
5.8 Mar 04

Snort 3 Detection Engine crashes when processing malformed VBA data due to improper decompression error handling, allowi

CVE-2026-20057 MEDIUM
5.8 Mar 04

Denial of service in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to crash the dete

CVE-2026-20054 MEDIUM
5.8 Mar 04

Improper error checking in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to trigger

Share

CVE-2026-20067 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy